# Verbatim developer documentation **The terms you signed off on are not the terms anymore.** Verbatim is a vendor evidence service for AI tools, operated by Junior Williams Consulting Inc. (Toronto). It captures what AI vendors publish about how they handle customer data, quotes it exactly, and diffs captures over time so silent changes cannot slip past. - Base URL: `https://api.trustcyber.ca` - MCP endpoint: `https://api.trustcyber.ca/mcp` - Authentication: none (NO_AUTH, public during the current pilot) - Provider: Junior Williams Consulting Inc. - Support: jr@trustcyber.ca - Human orders (spot-reviewed Evidence Pack, $149 CAD): https://square.link/u/FVyKXwpY ## What a packet answers For one vendor, one product, and one plan, a packet answers six questions from the vendor's own published documents (privacy policy, terms, data processing addendum, trust pages, subprocessor list): 1. `training_use` — Do they train their models on your data? 2. `retention` — How long do they keep your data? 3. `deletion` — What happens when you ask them to delete it? 4. `zero_data_retention` — Is zero-data-retention available, and on what conditions? 5. `processing_regions` — Where in the world is your data processed? 6. `subprocessors` — Who else touches it? Every answer is an exact quote with the source URL and the capture date. Where a vendor's documents do not answer a question, the packet says `NOT_SPECIFIED`. Nothing is paraphrased into a finding, and nothing is guessed. Coverage at 2026-10-20: 46 vendors, 136 of 276 dimensions answered with verified quoted passages (268 of 268 quotes checked against the captured source snapshots). Three vendors (Oracle AI, Sourcegraph Cody, Windsurf) are honestly 0 of 6: their silence is the finding. ## Tools (MCP and Composio) The same four tools are exposed over MCP at `/mcp`, over REST, and inside Composio as the custom toolkit `CUSTOM_VERBATIM` (registered and live-tested 2026-10-19 in the provider's own project). | Tool | Input | Returns | Intended rate | | --- | --- | --- | --- | | `verbatim_list_vendors` | none | Every covered vendor: slug, vendor, product, plan, plus archive-history coverage where it exists | Free | | `verbatim_get_packet` | `vendor_slug` (string) | Latest packet for that vendor (JSON), with an archive-history summary attached | $0.10 USD per packet | | `verbatim_compare_packet` | `vendor_slug` (string) | Diff of the two most recent captures: before/after quote pairs for every dimension that changed, or an honest explanation when a second capture does not exist yet | $0.05 USD per comparison, charged only when a comparison actually ran | | `verbatim_get_history` | `vendor_slug` (string) | Archive history: dated passage changes extracted from Internet Archive Wayback Machine captures, quarterly from 2023, each a before/after quote pair labelled persistent or provisional | $0.05 USD, priced as a change comparison | Archive history exists because vendors changed their terms long before Verbatim's first capture: the backfill read one archived capture per vendor source per quarter (2023 onward) through the same extractor and differ as the live captures. A change labelled `persistent` still held in the following quarter's capture; `provisional` changes are reported separately and never mixed into the persistent count. Quarterly archived packets carry per-source archive timestamps and archive URLs, so every historical quote can be checked against the archive itself. The rates above are the research-backed agent prices enacted 2026-10-23, replacing the original $5 / $12 guess: vendor list free, evidence packet $0.10 USD, change comparison $0.05 USD. On the Apify Actor the same prices apply (platform usage included), plus an all-46-vendors bundle at $2.99 USD per run; failed or unknown-vendor runs are not charged, and a comparison that returns `compared: false` is not charged. The $149 CAD human Evidence Pack above is a separate, human-priced product and is unchanged. The intended rates apply when Verbatim is listed in Composio Instant; payout and listing are Composio's provider pipeline, not self-serve. Direct REST/MCP calls are currently open during the pilot. ## REST endpoints ``` GET /health {"status": "ok", "vendors": 46} GET /vendors {"count": 46, "vendors": [{slug, vendor, product, plan}, ...]} GET /packet/ latest packet, JSON GET /packet/.md latest packet, Markdown POST /compare/ change comparison (JSON) GET /history archive-history coverage for every vendor GET /history/ dated archive changes for one vendor (JSON) GET /history// archived packet for one quarter, e.g. /history/anthropic/2025Q1 POST /mcp MCP (JSON-RPC 2.0) GET / product landing page (HTML) GET /docs this documentation (HTML) GET /docs.md this documentation (Markdown) GET /logo.svg product logo (SVG) ``` ### Examples ```bash curl https://api.trustcyber.ca/vendors curl https://api.trustcyber.ca/packet/anthropic curl https://api.trustcyber.ca/packet/anthropic.md curl -X POST https://api.trustcyber.ca/compare/anthropic curl https://api.trustcyber.ca/history/anthropic curl https://api.trustcyber.ca/history/anthropic/2025Q1 ``` MCP call (JSON-RPC): ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "verbatim_get_packet", "arguments": {"vendor_slug": "anthropic"} } } ``` ## Example packet excerpt (real data) Anthropic, Claude (Commercial / API), captured 2026-10-18, dimension `deletion`: > H.1.b. delete all copies of Customer Data (including Customer > Personal Data) processed by Anthropic or any Subprocessors, > except to the extent (i) Applicable Data Protection Laws or other > applicable legal or regulatory requirements requires storage of > the Customer Data, (ii) retention of the Customer Data by > Anthropic is necessary to resolve a dispute between the parties, > or (iii) retention of the Customer Data is necessary to combat > harmful use of the Services. Source: https://www.anthropic.com/legal/data-processing-addendum The same packet reports `zero_data_retention` and `processing_regions` as NOT_SPECIFIED for Anthropic's commercial terms: the documents captured do not state them. ## Compare behaviour `verbatim_compare_packet` and `POST /compare/` diff the two most recent dated snapshot captures of a vendor. The result names both dates, a change count, and for each change the dimension and the before/after quoted passages. When fewer than two captures exist, the result is `compared: false` with the capture dates that do exist. A comparison is never fabricated from a single capture. ## Errors - Unknown vendor slug: HTTP 404 (REST) or an MCP error result naming the valid discovery call, `verbatim_list_vendors`. - `GET /compare/`: HTTP 405; compare requires POST. - `GET /mcp`: HTTP 405; the MCP endpoint requires POST. ## What Verbatim is not Evidence, not legal advice, not a certification, and not a guarantee of how a vendor behaves. It shows what a vendor has committed to in public, quoted exactly and dated, so a review, negotiation, or audit starts from the document instead of from a sales page.